Yes, I'm using the Sony DLL to handle USB communications but I still need to prepare the packets.
As for the root fs limitation I'm going to have a look but I agree that most probably it's hard-coded. However, there are other ways to get into the device